ThreatFox: Venus Stealer IOCs

Hunt Hypothesis

This hypothesis targets the presence of known indicators of compromise associated with the Venus Stealer, a malicious tool frequently used to exfiltrate sensitive data from compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify potential intrusions early, mitigating the risk of credential theft or data exfiltration before the adversary achieves their objectives.

IOC Summary

Malware Family: Venus Stealer Total IOCs: 2 IOC Types: sha1_hash, md5_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Venus Stealer
let malicious_hashes = dynamic(["6ffde579ff31195cc105e07b2de055c65812d259", "e0cee01f0387179a8a9cb85323c56fe5"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Venus Stealer

False Positive Guidance

• Scenario: A DevOps engineer uses Ansible or Terraform to deploy a new microservice container that includes a standard logging agent (e.g., Fluentd or Vector) configured to write to a local file path matching the IOCs (e.g., C:\ProgramData\venus\logs\app.log or /var/log/venus/stealer.log).

  • Filter/Exclusion: Exclude processes where the parent process is ansible-playbook.exe, terraform.exe, or docker.exe and the file path resides under standard application data directories (C:\ProgramData\, /var/log/) rather than user profile directories.

• Scenario: An IT support technician runs a PSTools or Sysinternals script to collect diagnostic information from a user’s workstation, which temporarily creates a folder named venus in the user’s %TEMP% or %APPDATA% directory to store dump files before compression.

  • Filter/Exclusion: Exclude file creation events where the parent process is PsExec.exe, PsGetService.exe, or logman.exe, and the file path contains \TEMP\ or \AppData\Local\ with a timestamp-based naming convention.

• Scenario: A QA engineer executes a Selenium or Playwright browser automation test suite that uses a custom test harness named venus-test-runner which writes session state files to C:\Users\<user>\.cache\venus\ during test execution.

  • Filter/Exclusion: Exclude file system events where the parent process is node.exe, python.exe, or java.exe and the path contains .cache, test, or automation keywords, or where the user account belongs to a service account or QA group.

• Scenario: A database